diff --git a/Doc/whatsnew/3.7.rst b/Doc/whatsnew/3.7.rst
index 704333030f2b196..1d8cb820232f7f5 100644
--- a/Doc/whatsnew/3.7.rst
+++ b/Doc/whatsnew/3.7.rst
@@ -2994,3 +2994,15 @@ Build
 * On Windows, the build copies the OpenSSL DLLs that match the OpenSSL
   version in use (``libssl-3.dll`` for 3.x, ``libssl-1_1.dll`` for 1.1),
   from its ``bin`` directory when it has one.
+
+Notable changes in 3.7.17.10
+============================
+
+ensurepip
+---------
+
+* The bundled ``pip`` is upgraded from 24.0.post4 to 24.0.post5, the
+  ActiveState security release of pip 24.0 that upgrades its vendored
+  ``idna`` from 3.4 to 3.7.  This fixes CVE-2024-3651: crafted host names
+  made ``idna.encode()`` take quadratic time.  The rest of pip is unchanged
+  from 24.0.post4.
diff --git a/Include/patchlevel.h b/Include/patchlevel.h
index e8589ceaef79e1c..3885c3a0436dbb7 100644
--- a/Include/patchlevel.h
+++ b/Include/patchlevel.h
@@ -23,7 +23,7 @@
 #define PY_RELEASE_SERIAL       0
 
 /* Version as a string */
-#define PY_VERSION              "3.7.17.9"
+#define PY_VERSION              "3.7.17.10"
 /*--end constants--*/
 
 /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.
diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py
index edfba2ffadbe86e..151c16c3556a944 100644
--- a/Lib/ensurepip/__init__.py
+++ b/Lib/ensurepip/__init__.py
@@ -9,7 +9,7 @@
 __all__ = ["version", "bootstrap"]
 _PACKAGE_NAMES = ('setuptools', 'pip')
 _SETUPTOOLS_VERSION = "68.0.0.post3"
-_PIP_VERSION = "24.0.post4"
+_PIP_VERSION = "24.0.post5"
 _PROJECTS = [
     ("setuptools", _SETUPTOOLS_VERSION, "py3"),
     ("pip", _PIP_VERSION, "py3"),
diff --git a/Lib/ensurepip/_bundled/pip-24.0.post4-py3-none-any.whl b/Lib/ensurepip/_bundled/pip-24.0.post5-py3-none-any.whl
similarity index 92%
rename from Lib/ensurepip/_bundled/pip-24.0.post4-py3-none-any.whl
rename to Lib/ensurepip/_bundled/pip-24.0.post5-py3-none-any.whl
index 95fbde4f10912de..d3aa9a165d56c9c 100644
Binary files a/Lib/ensurepip/_bundled/pip-24.0.post4-py3-none-any.whl and b/Lib/ensurepip/_bundled/pip-24.0.post5-py3-none-any.whl differ
diff --git a/Misc/NEWS.d/next/Security/2026-11-03-17-00-00.gh-issue-160040.As37P5.rst b/Misc/NEWS.d/next/Security/2026-11-03-17-00-00.gh-issue-160040.As37P5.rst
new file mode 100644
index 000000000000000..39d45656d253c9e
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-11-03-17-00-00.gh-issue-160040.As37P5.rst
@@ -0,0 +1,3 @@
+Upgrade the bundled pip in :mod:`ensurepip` from 24.0.post4 to 24.0.post5.
+Its vendored idna is upgraded from 3.4 to 3.7, which fixes CVE-2024-3651
+(quadratic time in ``idna.encode()`` on crafted labels).